CVE-2020-29548

An issue was discovered in SmarterTools SmarterMail through 100.0.7537. Meddler-in-the-middle attackers can pipeline commands after a POP3 STLS command, injecting plaintext commands into an encrypted user session.
Command Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
8.1 HIGH
NETWORK
HIGH
NONE
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
mitreCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 76%
VendorProductVersion
smartertoolssmartermail
𝑥
≤ 100.0.7537
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://nostarttls.secvuln.info/
https://www.smartertools.com/smartermail/release-notes/current
https://nostarttls.secvuln.info/
https://www.smartertools.com/smartermail/release-notes/current